feat(git): enhance project connection management

apps/e2e/features/iam/git-permissions.feature

@@ -1,11 +1,13 @@
 @iam @git
 Feature: Who may use the Git integration
   Git access is four project actions (git:read, git:write, git:approve,
-  git:merge) and one workspace action (git.identities:manage) for the bot
-  identities. Every route is gated in the router. Linking a repository needs
-  both git:write on the project and git.identities:manage, because the shared
-  identity's installations are instance-wide. The webhook intake is public: the
-  Git platform calls it and the provider plugin verifies the signature.
+  git:merge), one project action for a project's own connections
+  (git.connections:manage) and one workspace action (git.identities:manage) for
+  the connections every project can use. Every route is gated in the router.
+  Linking a repository needs git:write: the connections it goes through were
+  made available to the project by whoever holds git.identities:manage, or by
+  the project itself. The webhook intake is public: the Git platform calls it
+  and the provider plugin verifies the signature.
 
   Rule: Reading and writing a project's Git integration
 
@@ -34,18 +36,25 @@ Feature: Who may use the Git integration
       Given the user already has a stored authenticated admin session
       And a project
 
-    Scenario: git:write alone cannot link a repository
+    Scenario: git:write alone passes the link gate
       Given a member whose project role grants "git:write"
+      Then linking a repository is not refused for permissions
+
+    Scenario: git:read cannot link a repository
+      Given a member whose project role grants only "git:read"
       Then linking a repository answers 403
-      But saving the project's Git settings is not refused
 
     Scenario: git.identities:manage alone cannot link a repository
       Given a user with the workspace action "git.identities:manage" and no role on the project
       Then linking a repository answers 403
 
-    Scenario: git:write together with git.identities:manage passes the gate
+    Scenario: A project's own connection needs git:write and git.connections:manage
+      Given members with only "git:write", only "git.connections:manage", and both
+      Then adding a project connection answers 403 for the first two and is not refused for the third
+
+    Scenario: The workspace action does not stand in for the project one
       Given a member with "git:write" on the project and "git.identities:manage" in the workspace
-      Then linking a repository is not refused for permissions
+      Then adding a project connection answers 403
 
   Rule: Approving and merging are their own actions
 

apps/e2e/features/projects/git-settings.feature

@@ -2,8 +2,9 @@
 Feature: A project's Git settings
   The Git tab of a project's settings links repositories and sets the
   automation. Reading it needs git:read. Linking a repository needs git:write
-  on the project and the workspace-level git.identities:manage; a writer
-  without it is told who to ask instead of being shown a form that would fail.
+  and a connection the project can use; a writer with no connection available
+  is told to ask someone who can manage Git connections instead of being shown
+  a form that would fail.
   The e2e stack has no Git provider plugin, so the provider endpoints are
   stubbed in the browser.
 
@@ -17,10 +18,9 @@ Feature: A project's Git settings
       Given the platform lists no Git provider
       When the user opens the project's Git settings
       Then the page says no Git provider is installed
-      And it offers a button to open the Git integration
 
     Scenario: An administrator links a repository
-      Given the platform lists a Git provider and the project has no repository
+      Given the platform lists a Git provider and a connection, and the project has no repository
       When the user opens the project's Git settings
       Then the "Repository" field and the "Link" button are shown
       When the user types "acme/web" and clicks "Link"
@@ -34,14 +34,14 @@ Feature: A project's Git settings
       And a project
       And the platform lists a Git provider and the project has no repository
 
-    Scenario: A writer without git.identities:manage is told to ask an administrator
-      Given a member with "git:read" and "git:write" and no workspace role
+    Scenario: A writer is told to ask for a connection when there is none
+      Given a member with "git:read" and "git:write" and no connection is available
       When the member opens the project's Git settings
-      Then the page explains that linking also needs the workspace permission to manage Git identities
+      Then the page asks them to find someone who can manage Git connections
       And there is no "Link" button
 
-    Scenario: A writer with git.identities:manage gets the form
-      Given a member with "git:read" and "git:write" and the workspace action "git.identities:manage"
+    Scenario: A writer gets the form once a connection is available
+      Given a member with "git:read" and "git:write" and a connection is available
       When the member opens the project's Git settings
       Then the "Repository" field and the "Link" button are shown